Windows zero-day bug BlueHammer sparks security debate

A new debate has flared up in cybersecurity circles over vulnerability disclosure policies. A researcher using the pseudonym Chaotic Eclipse has publicly released details of a Windows zero-day bug, citing dissatisfaction with the Microsoft Security Response Center's handling of the issue. The vulnerability, named BlueHammer, is a local privilege escalation flaw.

According to the researcher, they initially reported the problem to Microsoft through official channels. However, the review process and communication from MSRC proved so unsatisfactory that they decided to publish the details independently. This move goes against the accepted practice of coordinated disclosure, where developers are given time to fix bugs before public release.

From a technical standpoint, BlueHammer exploits a combination of TOCTOU (time-of-check to time-of-use) vulnerabilities and path confusion. A successful attack could allow access to the SAM database, where local user password hashes are stored, enabling privilege escalation to SYSTEM level and effectively granting full system control.

The researcher notes that exploiting this vulnerability requires existing local access to the device and doesn't work reliably in all environments, particularly on Windows server versions. While this reduces the threat's scale, it doesn't eliminate its seriousness. Microsoft has confirmed they're investigating the issue and preparing a fix, reiterating their commitment to responsible vulnerability disclosure. The company emphasized their goal of addressing such flaws before public disclosure to minimize user risks.